Mailing-List: contact cloudstack-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: cloudstack-dev@incubator.apache.org
Received-SPF: pass (nike.apache.org: domain of kelven.yang@citrix.com
 designates 66.165.176.63 as permitted sender)
From: Kelven Yang <kelven.yang@citrix.com>
To: "cloudstack-dev@incubator.apache.org"
	<cloudstack-dev@incubator.apache.org>
Date: Fri, 21 Sep 2012 10:26:30 -0700
Subject: realhostip certificate role in Cloudstack
Thread-Topic: realhostip certificate role in Cloudstack
Thread-Index: Ac2YHj3YmypRtblCSoiMmbHqrekQqw==
Message-ID: <CC81E918.F7E0%kelven.yang@citrix.com>
In-Reply-To: 
 <B1DF26ECC0458748AC97CECE2DA98D41012FA0450999@SJCPMAILBOX01.citrite.net>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/14.2.3.120616
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Periodically we get questions asking about what realhostip DNS name is
exactly doing in CloudStack. Realhostip.com domain exists to make HTTPS
work across all CloudStack installations in different customer sites,
without administrators to worry about how to load a SSL certificate due to
deployment environment changes.

SSL certificates are used in CloudStack system VMs to host HTTPS
connections, for example, console proxy VM and Secondary storage VM, both
uses it in its HTTP server. Realhostip.com SSL certificate is signed with
wild-match addresses, all DNS names under *.realhostip.com are qualified
to use the certificate. Because of the fact that every CloudStack customer
has its own environment, every each one has their own sets of system VMs
in their installations and each system VM instance has their own sets of
IP addresses. To use ONE certificate to apply for all these instances
among different customers, we came out with a solution by providing
dynamic DNS service hosted by CloudStack, the DDNS service basically
translates following form of DNS names to IP addresses

xxx-xxx-xxx-xxx.realhostip.com to IP address xxx.xxx.xxx.xxx

CloudStack has control of IP address in each installation, so whenever we
need a SSL certificate, does not matter which customer is running the
installation, with such DDNS service is available, we can always assign it
a suffix under realhostip.com domain on top of ever-changing IP addresses,
this is the trick we play to make ONE SSL certificate applicable
universally among all CloudStack installations.

In most of these cases, the ugly formed DNS name is not visible to end
users, since its main purpose is to help establish secure communication
channel (not truly to certify a site), however, there are cases that
customer may do care, therefore, Console proxy VM does provide
customizable way for users to use their own SSL certificates

Kelven